John Paczkowski spoke to executives at Carrier IQ. Even they’re backpedaling, pointing the finger at carriers:

The carriers. They decide what’s to be collected and how long
it’s stored — typically about 30 days. And according to Carrier
IQ, the data is in their control the whole time.

“It’s the operator that determines what data is collected,”
says Carrier IQ CEO Larry Lenhart. “They make that decision
based on their privacy standards and their agreement with their
users, and we implement it.”

On this point, Lenhart is particularly emphatic. “We capture
only the data they specify, and provide it to them,” he
reiterates. “We don’t capture more than that.”